Memory Corruption
Monthly
Local privilege escalation in the Windows 11 (version 26H1) Desktop Window Manager (DWM) allows an authenticated low-privileged user to gain SYSTEM-level control by exploiting a use-after-free (CWE-416) memory-corruption flaw. Reported by Microsoft and carrying a CVSS 3.1 score of 7.8, the flaw grants full confidentiality, integrity, and availability impact once triggered locally. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but DWM EoP bugs are a historically favored post-compromise primitive.
Local privilege escalation in the Desktop Window Manager (DWM) component of Windows 11 version 26H1 allows an authenticated local attacker to elevate to SYSTEM by triggering a use-after-free memory corruption condition. The CVSS 3.1 vector (AV:L/PR:L) confirms an already-authenticated low-privileged user is required, and full compromise of confidentiality, integrity, and availability follows successful exploitation. Microsoft has released a patch; there is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Local privilege escalation in the Windows Win32K kernel-mode subsystem allows an authenticated attacker to elevate to SYSTEM by exploiting a use-after-free (CWE-416) memory-corruption condition. The flaw affects a broad range of supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025). Reported by Microsoft with a patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Windows DirectX graphics subsystem allows an authenticated attacker with low privileges to elevate to SYSTEM by triggering a use-after-free (CWE-416) memory-corruption condition. The flaw affects a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.0 (High), tempered by high attack complexity.
Remote code execution in Windows Remote Desktop Services (RDS) allows an authenticated network attacker to run arbitrary code by triggering a use-after-free (CWE-416) memory corruption condition. The flaw affects a broad range of currently-supported Windows client and server builds - Windows 10 21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2022/2025 (including Server Core). It was reported by Microsoft with a CVSS 8.8 rating; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network vector combined with only low-privilege requirements makes it a strong patch priority.
Local privilege escalation in Microsoft Windows Sensor Data Service arises from a use-after-free (CWE-416) memory corruption flaw that an already-authenticated attacker can trigger to run code at higher privilege. It affects a broad range of client and server builds (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025). Reported by Microsoft with a patch available; no public exploit identified at time of analysis, and the CVSS:3.1 score is 7.0 (High).
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) lets an authenticated low-privileged user corrupt kernel memory to gain SYSTEM-level control. The flaw is a use-after-free (CWE-416) affecting a broad range of Windows client and server builds from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019-2025. Microsoft has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows an authenticated attacker to gain SYSTEM-level privileges by triggering a type-confusion (CWE-843) condition. The flaw affects a broad range of supported Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Reported internally by Microsoft with a vendor patch available; no public exploit identified at time of analysis.
Elevation of privilege in Microsoft Windows Management Services lets a low-privileged local user corrupt memory through a use-after-free (CWE-416) and gain higher privileges on Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025. A successful exploit yields high confidentiality, integrity, and availability impact, but the CVSS vector marks high attack complexity, reflecting the race-condition timing typically needed to win a use-after-free. Microsoft has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows an authenticated low-privileged user to elevate to SYSTEM by triggering a use-after-free memory corruption condition. The flaw affects a broad range of Windows client and server releases (Windows 10 1809 through Windows 11 26H1, and Windows Server 2019 through 2025) and was reported by Microsoft. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Local privilege escalation in Microsoft's NAT Helper Components (ipnathlp.dll), the driver behind Internet Connection Sharing and NAT translation on Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025. An authenticated attacker who already has low-privilege access can exploit a use-after-free memory corruption bug to run code at higher privilege (SYSTEM). No public exploit identified at time of analysis, and it is not listed in CISA KEV, but Microsoft has released a patch.
Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows a remote, unauthenticated attacker to crash or hang affected applications by triggering a type-confusion condition (CWE-843) over the network. The flaw was reported by Microsoft and a vendor patch is available via MSRC; there is no public exploit identified at time of analysis. The CVSS vector limits impact strictly to availability (A:H, C:N/I:N), meaning it is a service-disruption bug rather than a code-execution or data-exposure issue despite tag noise suggesting otherwise.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) lets an already-authenticated user execute code in kernel context and gain SYSTEM-level rights, affecting a broad Windows client and server range from Windows Server 2012 through Windows 11 25H2/26H1 and Server 2025. The flaw is a CWE-416 use-after-free that yields total technical impact (C:H/I:H/A:H). Microsoft has shipped a patch; there is no public exploit identified at time of analysis and CISA's SSVC framework lists exploitation as none, with a low EPSS of 0.25% (16th percentile).
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating from a guest partition corrupt kernel memory via a use-after-free and gain higher privileges, with a scope change (S:C) indicating a guest-to-host escape. Rated CVSS 9.9 and affecting a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025, this issue was reported by Microsoft and has a vendor patch available. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in the Windows SMB Server Network Transport driver (srvnet.sys) allows unauthenticated network attackers to run arbitrary code by triggering a use-after-free condition, affecting a broad range of Windows client and server releases from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N (9.8 Critical), exploitation needs no authentication or user interaction, giving this the structural profile of a wormable SMB flaw similar to prior srvnet.sys issues. No public exploit was identified at time of analysis and CISA SSVC lists exploitation as 'none', with a modest EPSS of 0.57% (43rd percentile).
Local privilege escalation in the Microsoft Windows Kernel allows an authenticated attacker to elevate to SYSTEM by exploiting a use-after-free (CWE-416) memory corruption condition, spanning Windows 10 (1607 through 22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2016 through 2025. Reported by Microsoft with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N), the flaw grants full confidentiality, integrity, and availability impact on the local system. No public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available.
Local privilege escalation in the Microsoft Windows Kernel (CWE-416 use-after-free) lets an already-authenticated low-privilege user corrupt kernel memory and gain SYSTEM-level control across a broad range of Windows 10, Windows 11, and Windows Server 2016 through 2025 builds. Microsoft self-reported the flaw and has shipped a patch through the Update Guide; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. With CVSS 7.8 (AV:L/PR:L) it is a classic Patch-Tuesday local EoP suitable as a second-stage primitive after initial access.
Local privilege escalation in the Windows MIDI Service Module on Windows 11 (versions 24H2, 25H2, and 26H1) allows an already-authenticated low-privileged user to elevate to higher privileges by triggering a use-after-free memory-corruption condition (CWE-416). Reported by Microsoft with a vendor patch already available; there is no public exploit identified at time of analysis and SSVC records exploitation status as none. EPSS is low at 0.25% (16th percentile), consistent with a locally-exploitable EoP that is not yet weaponized.
Local privilege escalation in the Windows MIDI Service Module affects Windows 11 versions 24H2, 25H2, and 26H1, where a use-after-free (CWE-416) memory-corruption flaw lets an already-authenticated local user elevate to higher privileges. Exploitation requires winning a race condition (high attack complexity), and Microsoft has released a fix; no public exploit identified at time of analysis. Rated CVSS 7.0 with full confidentiality, integrity, and availability impact once triggered.
Local privilege elevation in the Windows WebView component affects a broad range of currently-supported Windows client and server builds (Windows 10 1809 through Windows 11 26H1, and Windows Server 2019/2022/2025). By triggering a use-after-free (CWE-416) memory-corruption condition, an already-authenticated low-privilege attacker can execute code in a higher-privilege context, yielding full confidentiality, integrity, and availability impact on the local system. Microsoft has released a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Local privilege escalation in Microsoft XML Core Services (MSXML) lets an already-authenticated user on affected Windows 10, Windows 11, and Windows Server systems corrupt memory via a use-after-free (CWE-416) and run code at elevated privilege. The flaw was reported by Microsoft and is patched; there is no public exploit identified at time of analysis, and EPSS estimates a low 0.25% (16th percentile) exploitation probability. Impact is total (high confidentiality, integrity, and availability) but requires prior local access.
Arbitrary code execution in Microsoft Office Excel arises from a use-after-free (CWE-416) memory-corruption flaw affecting Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, Office for Mac, and Office Online Server. The CVSS 3.1 vector (AV:L/UI:R) makes this a user-interaction-dependent, locally-scoped issue: a victim must open a maliciously crafted Excel workbook, after which the attacker gains code execution in the user's security context. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but a vendor patch is available.
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary code in the context of the current user when a victim opens a maliciously crafted document. The flaw affects a broad Office footprint including Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024 (Windows and Mac), and related SharePoint Server products that process Word documents. Microsoft has released a patch; no public exploit has been identified at time of analysis, and neither KEV nor EPSS/POC signals were provided in the input.
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, and Word 2016) allows an attacker to run arbitrary code by exploiting a use-after-free memory corruption flaw when a victim opens a maliciously crafted document. The CVSS 3.1 base score is 7.8 with a local attack vector requiring user interaction; there is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. Microsoft, which reported the issue itself, has released a patch.
Local code execution in Microsoft Excel (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, and Office Online Server) arises from a type-confusion flaw (CWE-843) in how Excel parses spreadsheet content. An attacker who convinces a victim to open a malicious workbook can run arbitrary code in the context of the current user, gaining high confidentiality, integrity, and availability impact. Reported by Microsoft with a patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local arbitrary code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office for Mac 2021/2024) arises from a type-confusion flaw (CWE-843) that lets an attacker run code in the context of the current user when a victim opens a crafted file. The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:N/UI:R) reflecting local vector with required user interaction and high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a vendor patch is available via MSRC.
Local code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office for Mac) stems from a use-after-free memory corruption (CWE-416) that an attacker triggers when a victim opens a maliciously crafted document. Rated CVSS 7.8 with high confidentiality, integrity, and availability impact, exploitation requires user interaction but no prior authentication, letting an attacker run arbitrary code in the context of the current user. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Microsoft has released a fix, so patching should be prioritized during the normal Patch Tuesday cycle.
Local code execution in Microsoft Excel (Office 2016 through LTSC 2024, Microsoft 365 Apps, and Mac editions) allows an attacker to run arbitrary code by tricking a user into opening a maliciously crafted spreadsheet that triggers a type-confusion condition in Excel's file parser. The CVSS 3.1 score is 7.8 (High) with the local vector reflecting file-open exploitation rather than remote-network access, and success requires user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, Microsoft 365 Apps, and Office for Mac 2021/2024) arises from a use-after-free memory corruption flaw that an attacker triggers by convincing a user to open a maliciously crafted Office document. Successful exploitation runs arbitrary code in the context of the current user, yielding full confidentiality, integrity, and availability impact on the host. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; Microsoft has published a patch via MSRC.
Local code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, Microsoft 365 Apps, and the macOS editions) arises from a use-after-free memory-corruption flaw (CWE-416) that lets an attacker run arbitrary code in the context of the current user after the victim opens a maliciously crafted document. The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:N/UI:R) with high impact to confidentiality, integrity, and availability, and requires user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a vendor patch is available via MSRC.
Local code execution in Microsoft Office Excel (across Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, and their macOS equivalents) arises from a use-after-free (CWE-416) memory-corruption flaw triggered when a user opens a maliciously crafted spreadsheet. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates an unauthenticated attacker can achieve full confidentiality, integrity, and availability impact but requires the victim to open a file, making it a classic phishing-delivered client-side bug. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Excel memory-corruption bugs are historically attractive targets.
Local code execution in Microsoft Office (including Microsoft 365 Apps for Enterprise, Office 2016/2019, and Office LTSC 2021/2024) stems from a use-after-free memory-corruption flaw (CWE-416). An attacker who convinces a user to open a specially crafted Office document can execute arbitrary code in the context of the current user, gaining full confidentiality, integrity, and availability impact. Exploitation requires user interaction (opening a malicious file) and there is no public exploit identified at time of analysis.
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw affecting a broad range of Windows 10, Windows 11, and Windows Server releases (Server 2012 through Server 2025). Per the CVSS vector an unauthenticated attacker with local access can achieve high-impact code execution with no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Microsoft has released a patch through the MSRC update guide.
Local privilege escalation in the Windows Clipboard Server (Cliprdr/RDP clipboard virtual channel service) affects a broad range of Windows 10, Windows 11, and Windows Server builds (from 1809 through 11 26H1 and Server 2025). An authenticated local attacker who can trigger a use-after-free (CWE-416) in the service can corrupt memory to run code at elevated (SYSTEM-level) privilege. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; Microsoft has released a patch.
Remote code execution in Microsoft Windows OLE (Object Linking and Embedding) allows an unauthorized network attacker to run arbitrary code by triggering a type-confusion condition (CWE-843) in the OLE component. The flaw affects a broad range of client and server SKUs from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025, and carries a CVSS 8.1 (High) rating. No privileges or authentication are required per the CVSS vector, though the high attack complexity (AC:H) means exploitation depends on winning a specific timing or memory-state condition; there is no public exploit identified at time of analysis and it is not on CISA KEV.
Local privilege escalation in the Microsoft Windows Kernel affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a use-after-free memory-corruption flaw lets an already-authenticated local user execute code with SYSTEM-level privileges. No public exploit identified at time of analysis, and CISA SSVC records exploitation as none; the low EPSS score (0.32%, 24th percentile) reflects the absence of observed exploitation, though the total technical impact makes it a valuable second-stage escalation primitive. Reported by Microsoft with a vendor patch available.
Local privilege escalation in the Microsoft Windows Kernel allows an authenticated attacker to gain SYSTEM-level control by exploiting a use-after-free (CWE-416) memory corruption condition. The flaw affects a broad range of Windows client and server builds - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025 - and was reported by Microsoft with a patch available. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.8 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
Local privilege escalation in Microsoft Windows Media (a component shipping in Windows 11 versions 24H2, 25H2, and 26H1) lets an authenticated local attacker execute code at elevated privilege by triggering a use-after-free (CWE-416) memory-corruption condition. Reported by Microsoft with a vendor patch available, it carries CVSS 7.8 (High) and can yield full confidentiality, integrity, and availability compromise of the host. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Microsoft Windows USB Print Driver (usbprint) affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a use-after-free memory-corruption flaw lets an already-authenticated local user execute code with elevated (SYSTEM-level) privileges. Reported by Microsoft with a vendor patch available and an SSVC 'total' technical-impact rating, it currently has no public exploit and a low EPSS score (0.25%, 16th percentile), indicating no observed exploitation to date. The bug requires an existing low-privilege foothold on the machine, making it a post-compromise escalation primitive rather than an initial-access vector.
Local privilege escalation in Microsoft Windows NTFS (New Technology File System) driver lets an already-authenticated low-privileged user corrupt kernel memory via a use-after-free (CWE-416) and elevate to SYSTEM. The flaw affects a broad Windows client and server matrix (Windows 10 1809 through Windows 11 26H1, Windows Server 2019/2022/2025). It has no public exploit identified at time of analysis and is not on CISA KEV, but as a Microsoft-reported, patched NTFS kernel bug it is a routine patch-priority item on standard Patch Tuesday cycles.
Privilege escalation in the Windows Remote Access Connection Manager (RasMan) service lets an authenticated, low-privileged attacker corrupt memory over the network to gain higher privileges on affected Windows 10, 11, and Server systems. The flaw is a CWE-416 use-after-free carrying a CVSS 8.8 with high impact to confidentiality, integrity, and availability. Microsoft has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in the Microsoft Message Queuing (MSMQ) service across Windows 10, Windows 11 (through 26H1), and Windows Server 2012-2025 allows an authorized (PR:L) attacker to run arbitrary code over the network by triggering a use-after-free memory-corruption condition. Microsoft self-reported the flaw and has shipped fixed builds; SSVC rates exploitation as none and EPSS is low (0.48%, 38th percentile), so there is no public exploit identified at time of analysis despite the high 8.8 CVSSv3.1 base score.
Local privilege escalation in the Microsoft Windows Installer (MSI) service affects a broad range of Windows client and server releases, from Windows 10 1607 and Server 2012 through Windows 11 25H2/26H1 and Server 2025. A use-after-free (CWE-416) in the Windows Installer component lets a low-privileged authenticated attacker who already has local code execution corrupt memory to run code with elevated (SYSTEM-level) privileges. No public exploit identified at time of analysis and the SSVC exploitation status is 'none', but the technical impact is rated total and Microsoft has shipped a patch.
Privilege escalation in the Windows Netlogon service allows an authenticated network attacker to gain elevated privileges by triggering a use-after-free (CWE-416) memory-corruption condition. The flaw affects a broad range of supported Windows client and server builds, from Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025, and was reported by Microsoft. There is no public exploit identified at time of analysis and CISA SSVC currently rates exploitation as none, with a low EPSS of 0.62%.
Privilege elevation via a use-after-free in the Microsoft Windows DNS component lets a network-based, unauthenticated attacker corrupt memory and potentially gain higher privileges on affected Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 systems. Microsoft rates it CVSS 9.8, and the SSVC assessment lists total technical impact but notes no observed exploitation and that it is not automatable. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.67% (48th percentile).
Elevation of privilege in the Windows Runtime (WinRT) component affects Windows 10 (21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2025, where a use-after-free memory-corruption flaw lets an already-authenticated local user run code at higher privilege. Microsoft has released a patch and reported the issue; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. Given the CVSS 7.8 (Important) rating and full C/I/A impact, this is a standard local privilege-escalation risk suited for regular patch prioritization rather than emergency response.
Local privilege escalation in the Windows Graphics Kernel component allows an authenticated attacker to elevate to SYSTEM by triggering a use-after-free (CWE-416) memory-corruption condition. All currently supported Windows client and server builds are affected - from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. No public exploit identified at time of analysis; Microsoft has released a patch, and the CVSS 7.8 (Important) rating reflects high impact but a local-access, low-privilege prerequisite.
Local privilege escalation in the Microsoft Windows Kernel lets an authenticated attacker who already has low-privileged code execution on a host elevate to SYSTEM by exploiting a use-after-free (CWE-416) memory corruption. It affects a broad range of supported Windows client and server builds - Windows 10 (1809/21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2019/2022/2025 - and Microsoft has released a patch. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation appears unproven publicly despite the reliably-exploitable nature of kernel UAF flaws.
Local privilege escalation in the Microsoft Windows Kernel lets an authenticated low-privileged user exploit a use-after-free (CWE-416) memory corruption flaw to elevate to SYSTEM across a broad range of Windows 10, Windows 11, and Windows Server builds. Reported by Microsoft and rated CVSS 7.8, it is not currently in CISA KEV and has no public exploit identified at time of analysis; the EPSS score is low at 0.26% (17th percentile). A vendor patch is available via the MSRC update guide.
Local privilege escalation in the Windows Backup Engine affects a broad range of Windows 10 (21H2, 22H2) and Windows 11 (24H2, 25H2, 26H1) builds, where a use-after-free (CWE-416) lets an already-authenticated local attacker corrupt memory and gain SYSTEM-level control. Microsoft rates it 7.8 (AV:L/PR:L) with total confidentiality, integrity, and availability impact, and a patch is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.25% (16th percentile).
Local privilege escalation in Microsoft Windows (Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025) arises from a use-after-free memory-corruption flaw (CWE-416) that lets an already-authenticated local user run code at elevated privilege. The CVSS 3.1 base score is 7.8 with a scope-changed vector, and Microsoft has shipped a fix via MSRC. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is currently theoretical rather than observed.
Local privilege escalation in the Windows Brokering File System affects Windows 11 24H2/25H2/26H1 and Windows Server 2025, where a use-after-free (CWE-416) lets an already-authenticated local user corrupt memory to elevate to higher privileges (typically SYSTEM). Microsoft has released a patch and rates it 7.8 (High). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Microsoft's Remote Desktop Client (the RDP client, mstsc.exe, shipped across Windows 10, Windows 11, and Windows Server 2012 through 2025) allows an unauthorized attacker to run arbitrary code over the network by triggering a use-after-free memory-corruption condition. Exploitation requires the victim to connect to an attacker-controlled or compromised RDP endpoint (UI:R), after which the malicious server can corrupt client-side memory to achieve full code execution. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; a vendor patch is available from Microsoft.
Local privilege escalation in the Windows Runtime (WinRT) component of Windows 10, Windows 11, and Windows Server allows an authenticated attacker to run arbitrary code with elevated (SYSTEM-level) privileges by triggering a use-after-free memory-corruption condition (CWE-416). Microsoft has released a patch, but there is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. The CVSS 3.1 score of 7.8 (High) with a fully local vector reflects meaningful post-compromise impact but requires the attacker to already have a foothold on the host.
Remote code execution in the Microsoft Message Queuing (MSMQ) Queue Manager affects a broad range of Windows client and server releases, from Windows 10 1607 and Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025. A use-after-free (CWE-416) in the queue manager lets a remote, unauthenticated attacker who can reach the MSMQ service execute arbitrary code with total impact to confidentiality, integrity, and availability. Microsoft has released patches; there is no public exploit identified at time of analysis and the EPSS probability is modest at 0.52%.
Local privilege escalation in the Windows Brokering File System component affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a use-after-free memory corruption (CWE-416) lets an already-authenticated local user elevate to higher privileges. Microsoft rates it CVSS 7.8 with full confidentiality, integrity, and availability impact, and has released a patch. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Windows Connected User Experiences and Telemetry service (DiagTrack) lets an already-authenticated user run arbitrary code with SYSTEM-level rights by triggering a CWE-843 type-confusion condition. The flaw affects a broad range of currently-supported Windows client and server builds, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Local privilege escalation in the Microsoft Windows Content Delivery Manager component lets an authenticated low-privileged user elevate to SYSTEM by triggering a use-after-free (CWE-416) memory-corruption condition. The flaw affects a broad range of client and server builds (Windows 10 1809 through Windows 11 26H1, plus Server 2019 and Server 2025), and Microsoft has released a patch. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Windows Runtime (WinRT) affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a use-after-free memory-corruption flaw lets a locally authenticated attacker elevate to higher privileges. Per the CVSS vector an already-authorized low-privileged user (PR:L) can execute the attack without user interaction, gaining full confidentiality, integrity, and availability impact on the host. There is no public exploit identified at time of analysis and CISA SSVC rates current exploitation as none, though a vendor patch is available from Microsoft.
Privilege escalation in Windows Remote Desktop Services (RDS) lets an authenticated, low-privileged attacker elevate to higher privileges across a network by triggering a use-after-free (CWE-416) memory-corruption condition in the RDS component. The flaw spans a broad range of supported Windows client and server releases (Windows 10/11 and Windows Server 2012 through 2025). Microsoft has released a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Local privilege escalation in the Windows Kernel affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 (including Server Core), where an authorized attacker can exploit a use-after-free (CWE-416) memory-corruption condition to elevate privileges to SYSTEM. The flaw was reported by Microsoft, which has released a patch, and carries a CVSS 7.8 rating driven entirely by high confidentiality, integrity, and availability impact once local access is obtained. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Microsoft Windows Kernel lets an already-authenticated attacker win a use-after-free race (CWE-416) to gain SYSTEM-level control, affecting a broad range of client and server builds from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released a patch and there is no public exploit identified at time of analysis. The moderate 7.0 score reflects high attack complexity (a timing-dependent race) offset by full confidentiality, integrity and availability impact once triggered.
Local privilege escalation in Microsoft Windows Media (the Windows Media component/codec subsystem) allows an already-authenticated local attacker to elevate to SYSTEM by triggering a use-after-free (CWE-416) memory corruption condition. The flaw affects a broad range of currently-supported Windows client and server releases, from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Local privilege escalation in the Windows Runtime (WinRT) affects a broad range of supported Windows client and server releases, from Windows 10 1809 and Windows Server 2019 through Windows 11 26H1 and Windows Server 2025. An authorized local attacker who can execute low-privilege code can trigger a use-after-free (CWE-416) memory-corruption condition to elevate privileges, yielding full confidentiality, integrity, and availability impact on the host. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Microsoft has released a patch.
Local privilege escalation in Microsoft Windows Runtime (WinRT) affects a broad range of Windows client and server builds, from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. An authorized local attacker who can run low-privileged code can trigger a use-after-free memory-corruption condition to elevate to higher privileges, with high confidentiality, integrity, and availability impact implying a path to SYSTEM. No public exploit identified at time of analysis, and the flaw is not on CISA KEV; a vendor patch is available.
Local privilege escalation in the Windows DirectX graphics kernel subsystem allows an authenticated attacker to elevate to SYSTEM by triggering a use-after-free (CWE-416) memory-corruption condition across Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025. The CVSS 3.1 vector (7.8, AV:L/PR:L) confirms local access and low existing privileges are required with no user interaction, yielding full confidentiality, integrity, and availability impact. Reported by Microsoft with a vendor patch available; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Local privilege escalation in the Windows Media component across Windows 10, Windows 11, and Windows Server (2016 through 2025) allows an authenticated low-privileged attacker to elevate to SYSTEM by exploiting a use-after-free memory corruption flaw. Microsoft has released patches and reports no public exploit identified at time of analysis; EPSS is low at 0.25% and CISA SSVC records exploitation status as 'none', though technical impact is rated total. Given the ubiquity of the Windows Media stack, this is a routine but broadly applicable Patch-Tuesday-class local EoP.
Privilege escalation in Microsoft Windows Runtime (WinRT) lets an authenticated attacker who can reach an affected host over the network exploit a use-after-free memory corruption to gain higher privileges, with total confidentiality, integrity, and availability impact per CVSS 8.8. Affected platforms include Windows 11 (24H2, 25H2, 26H1), Windows Server 2025, and its Server Core installation. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.48%, 38th percentile), but the technical impact is rated total and a vendor patch is available.
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker gain SYSTEM-level control by abusing a type-confusion (CWE-843) condition, affecting a broad range of Windows client and server builds from Windows Server 2012 through Windows 11 25H2/26H1 and Server 2025. Successful exploitation yields total loss of confidentiality, integrity, and availability on the host, though there is no public exploit identified at time of analysis and CISA's SSVC framework rates exploitation as 'none' and non-automatable. EPSS is low (0.29%, 21st percentile), consistent with a locally-scoped bug that requires prior code execution rather than a remotely wormable threat.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated low-privileged attacker to gain SYSTEM-level control by triggering a use-after-free condition in the kernel networking driver. The flaw affects a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Reported by Microsoft with a vendor patch available; no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.31%).
Local privilege escalation in the Windows Internal System User Profile component allows an already-authenticated attacker to gain elevated (SYSTEM-level) privileges by triggering a use-after-free memory corruption condition (CWE-416). The flaw affects Windows 10 (21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2025 including Server Core. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 7.8 rating and full high impact on confidentiality, integrity, and availability make it a meaningful patch-cycle priority.
Local privilege escalation in Windows Kernel-Mode Drivers on Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 lets an already-authenticated low-privilege user corrupt kernel memory via a use-after-free (CWE-416) and gain SYSTEM-level control. Reported by Microsoft with a vendor patch available; there is no public exploit identified at time of analysis and CISA SSVC rates exploitation as none, though the technical impact is total. EPSS is low (0.20%, 10th percentile), consistent with a not-yet-exploited but fully impactful local EoP.
Local privilege escalation in the Windows Application Model (the subsystem underlying UWP/packaged app lifecycle and activation) lets an authorized attacker with an existing low-privileged foothold gain SYSTEM-level control by triggering a use-after-free memory-corruption condition. All supported Windows client and server builds from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through Server 2025 are affected. This is a Microsoft-reported flaw with a vendor patch available; there is no public exploit identified at time of analysis and it is not on CISA KEV.
Local privilege escalation in the Windows Unified Consent System (UCS) lets an already-authenticated attacker exploit a use-after-free memory-corruption flaw (CWE-416) to gain higher privileges, potentially up to SYSTEM. It affects a broad range of current Windows client and server builds including Windows 10 21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2025. Reported by Microsoft with a CVSS 3.1 base score of 7.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Windows TCP/IP stack lets a low-privileged authenticated user corrupt kernel memory via a use-after-free (CWE-416) and elevate to SYSTEM. It affects a broad range of Windows 10, Windows 11, and Windows Server builds through 2025, was reported by Microsoft, and carries CVSS 7.8; there is no public exploit identified at time of analysis and EPSS is low (0.20%, 10th percentile).
Local privilege escalation in Windows Kernel-Mode Drivers on Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 allows an authenticated low-privileged attacker to gain SYSTEM-level control by exploiting a use-after-free (CWE-416) memory-corruption condition. Microsoft has published a patch, and no public exploit has been identified at time of analysis; EPSS is low at 0.20% (10th percentile) and CISA SSVC records exploitation as none, though the technical impact is rated total. Successful exploitation grants full confidentiality, integrity, and availability compromise of the affected host.
Local privilege elevation in the Microsoft Windows TCP/IP networking stack lets an already-authenticated, low-privileged user corrupt kernel memory via a use-after-free (CWE-416) and gain SYSTEM-level control. The flaw affects a broad range of client and server SKUs from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025, including Server Core installations. Microsoft reported the issue and has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Local privilege escalation in Windows Secure Kernel Mode (VBS/Isolated User Mode trust boundary) affects Windows 11 24H2/25H2/26H1 and Windows Server 2025, where a use-after-free (CWE-416) lets an already-authenticated local attacker gain elevated privileges. Microsoft rates it 7.0 (High) with a local, high-complexity vector requiring low privileges and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation would require winning a memory-corruption race after already having a foothold.
Local privilege escalation in the Microsoft Windows Kernel allows an already-authenticated attacker to gain SYSTEM-level control by exploiting a use-after-free (CWE-416) memory corruption condition. The flaw affects a broad range of supported Windows client and server releases (Windows 10 1809 through Windows 11 26H1, and Windows Server 2019 through 2025) and, per the CVSS 7.8 vector, yields full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; Microsoft has released a patch.
Local privilege escalation in the Microsoft Brokering File System affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a use-after-free (CWE-416) memory-corruption flaw lets an already-authenticated local user execute code with elevated (typically SYSTEM) privileges. Microsoft has released a patch and reported the issue itself; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a locally-exploitable but high-impact elevation path.
Local privilege escalation in the Microsoft Windows Graphics Kernel component allows a low-privileged local user to elevate to SYSTEM by exploiting a use-after-free (CWE-416) memory corruption condition. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server releases, was reported by Microsoft, and has a vendor-released patch available. No public exploit is identified at time of analysis and it is not listed in CISA KEV; the high attack complexity (AC:H) makes reliable exploitation non-trivial.
Local privilege escalation in the Windows Kernel lets an already-authenticated, low-privileged user corrupt kernel memory via a use-after-free (CWE-416) and gain higher privileges on the host. The flaw affects a broad range of currently-supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025); Microsoft has shipped a fix. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Local privilege escalation in the Windows taskbar (Internal Task Bar component) allows an authenticated attacker to elevate to higher privileges by exploiting a use-after-free memory corruption flaw. The issue affects a broad range of current Windows client and server builds (Windows 10 21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2025), was reported by Microsoft itself, and is fixed via a vendor patch. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in Windows Runtime (WinRT) on Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 allows an authenticated local user to gain higher privileges by exploiting a use-after-free memory-corruption flaw (CWE-416). Successful exploitation yields high confidentiality, integrity, and availability impact, effectively enabling escalation to SYSTEM-level control on the host. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the elevated attack complexity (AC:H) indicates exploitation requires winning a race or meeting specific timing/heap conditions.
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-level) privileges by triggering a use-after-free condition (CWE-416) in kernel memory. The flaw affects a broad range of supported Windows client and server releases, from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-after-free (CWE-416) and gain full control of the host. The CVSS 3.1 vector (AV:L/PR:L, scope-changed with C:H/I:H/A:H) reflects a low-privileged local user escalating to SYSTEM-level compromise across a broad range of Windows 10, Windows 11, and Windows Server builds. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Microsoft has released a patch.
Local privilege escalation in the Windows Kernel Mode Driver affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a use-after-free (CWE-416) lets an already-authenticated local attacker corrupt kernel memory and elevate to SYSTEM. Reported by Microsoft with a patch already available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 7.8 (AV:L/PR:L) reflects a high-impact but locally-scoped flaw requiring an existing foothold on the host.
Local privilege escalation in the Windows Storage component affects a broad range of Windows client and server builds (Windows 10 1809 through Windows 11 26H1, and Windows Server 2019 through 2025). By exploiting a use-after-free memory-corruption flaw (CWE-416), an already-authenticated local attacker can elevate to SYSTEM-level privileges. Reported by Microsoft with a patch available; there is no public exploit identified at time of analysis, EPSS is low (0.15%), and CISA SSVC records exploitation status as none.
Local privilege escalation in Microsoft Windows Hyper-V (Windows 11 24H2/25H2/26H1 and Windows Server 2022/2025) stems from a use-after-free memory-corruption condition that lets an attacker with a local foothold execute code at elevated, potentially SYSTEM/hypervisor-level privilege. Microsoft rates it CVSS 8.4 with total confidentiality, integrity, and availability impact, and there is no public exploit identified at time of analysis. EPSS is low (0.24%, 16th percentile) and CISA SSVC lists exploitation status as none, so this is a high-severity patch-on-cycle item rather than an actively exploited emergency.
Remote code execution in Microsoft Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized network attacker to run arbitrary code by triggering a use-after-free (CWE-416) memory-corruption condition. The flaw affects a broad range of Windows client and server releases from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025, and per its CVSS 9.8 vector requires no authentication or user interaction. There is no public exploit identified at time of analysis, and the EPSS probability is modest (0.61%), so despite the critical score exploitation is not yet observed.
Local privilege escalation in the Windows 11 (version 26H1) Desktop Window Manager (DWM) allows an authenticated low-privileged user to gain SYSTEM-level control by exploiting a use-after-free (CWE-416) memory-corruption flaw. Reported by Microsoft and carrying a CVSS 3.1 score of 7.8, the flaw grants full confidentiality, integrity, and availability impact once triggered locally. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but DWM EoP bugs are a historically favored post-compromise primitive.
Local privilege escalation in the Desktop Window Manager (DWM) component of Windows 11 version 26H1 allows an authenticated local attacker to elevate to SYSTEM by triggering a use-after-free memory corruption condition. The CVSS 3.1 vector (AV:L/PR:L) confirms an already-authenticated low-privileged user is required, and full compromise of confidentiality, integrity, and availability follows successful exploitation. Microsoft has released a patch; there is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Local privilege escalation in the Windows Win32K kernel-mode subsystem allows an authenticated attacker to elevate to SYSTEM by exploiting a use-after-free (CWE-416) memory-corruption condition. The flaw affects a broad range of supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025). Reported by Microsoft with a patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Windows DirectX graphics subsystem allows an authenticated attacker with low privileges to elevate to SYSTEM by triggering a use-after-free (CWE-416) memory-corruption condition. The flaw affects a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.0 (High), tempered by high attack complexity.
Remote code execution in Windows Remote Desktop Services (RDS) allows an authenticated network attacker to run arbitrary code by triggering a use-after-free (CWE-416) memory corruption condition. The flaw affects a broad range of currently-supported Windows client and server builds - Windows 10 21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2022/2025 (including Server Core). It was reported by Microsoft with a CVSS 8.8 rating; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network vector combined with only low-privilege requirements makes it a strong patch priority.
Local privilege escalation in Microsoft Windows Sensor Data Service arises from a use-after-free (CWE-416) memory corruption flaw that an already-authenticated attacker can trigger to run code at higher privilege. It affects a broad range of client and server builds (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025). Reported by Microsoft with a patch available; no public exploit identified at time of analysis, and the CVSS:3.1 score is 7.0 (High).
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) lets an authenticated low-privileged user corrupt kernel memory to gain SYSTEM-level control. The flaw is a use-after-free (CWE-416) affecting a broad range of Windows client and server builds from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019-2025. Microsoft has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows an authenticated attacker to gain SYSTEM-level privileges by triggering a type-confusion (CWE-843) condition. The flaw affects a broad range of supported Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Reported internally by Microsoft with a vendor patch available; no public exploit identified at time of analysis.
Elevation of privilege in Microsoft Windows Management Services lets a low-privileged local user corrupt memory through a use-after-free (CWE-416) and gain higher privileges on Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025. A successful exploit yields high confidentiality, integrity, and availability impact, but the CVSS vector marks high attack complexity, reflecting the race-condition timing typically needed to win a use-after-free. Microsoft has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows an authenticated low-privileged user to elevate to SYSTEM by triggering a use-after-free memory corruption condition. The flaw affects a broad range of Windows client and server releases (Windows 10 1809 through Windows 11 26H1, and Windows Server 2019 through 2025) and was reported by Microsoft. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Local privilege escalation in Microsoft's NAT Helper Components (ipnathlp.dll), the driver behind Internet Connection Sharing and NAT translation on Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025. An authenticated attacker who already has low-privilege access can exploit a use-after-free memory corruption bug to run code at higher privilege (SYSTEM). No public exploit identified at time of analysis, and it is not listed in CISA KEV, but Microsoft has released a patch.
Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows a remote, unauthenticated attacker to crash or hang affected applications by triggering a type-confusion condition (CWE-843) over the network. The flaw was reported by Microsoft and a vendor patch is available via MSRC; there is no public exploit identified at time of analysis. The CVSS vector limits impact strictly to availability (A:H, C:N/I:N), meaning it is a service-disruption bug rather than a code-execution or data-exposure issue despite tag noise suggesting otherwise.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) lets an already-authenticated user execute code in kernel context and gain SYSTEM-level rights, affecting a broad Windows client and server range from Windows Server 2012 through Windows 11 25H2/26H1 and Server 2025. The flaw is a CWE-416 use-after-free that yields total technical impact (C:H/I:H/A:H). Microsoft has shipped a patch; there is no public exploit identified at time of analysis and CISA's SSVC framework lists exploitation as none, with a low EPSS of 0.25% (16th percentile).
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating from a guest partition corrupt kernel memory via a use-after-free and gain higher privileges, with a scope change (S:C) indicating a guest-to-host escape. Rated CVSS 9.9 and affecting a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025, this issue was reported by Microsoft and has a vendor patch available. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in the Windows SMB Server Network Transport driver (srvnet.sys) allows unauthenticated network attackers to run arbitrary code by triggering a use-after-free condition, affecting a broad range of Windows client and server releases from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N (9.8 Critical), exploitation needs no authentication or user interaction, giving this the structural profile of a wormable SMB flaw similar to prior srvnet.sys issues. No public exploit was identified at time of analysis and CISA SSVC lists exploitation as 'none', with a modest EPSS of 0.57% (43rd percentile).
Local privilege escalation in the Microsoft Windows Kernel allows an authenticated attacker to elevate to SYSTEM by exploiting a use-after-free (CWE-416) memory corruption condition, spanning Windows 10 (1607 through 22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2016 through 2025. Reported by Microsoft with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N), the flaw grants full confidentiality, integrity, and availability impact on the local system. No public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available.
Local privilege escalation in the Microsoft Windows Kernel (CWE-416 use-after-free) lets an already-authenticated low-privilege user corrupt kernel memory and gain SYSTEM-level control across a broad range of Windows 10, Windows 11, and Windows Server 2016 through 2025 builds. Microsoft self-reported the flaw and has shipped a patch through the Update Guide; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. With CVSS 7.8 (AV:L/PR:L) it is a classic Patch-Tuesday local EoP suitable as a second-stage primitive after initial access.
Local privilege escalation in the Windows MIDI Service Module on Windows 11 (versions 24H2, 25H2, and 26H1) allows an already-authenticated low-privileged user to elevate to higher privileges by triggering a use-after-free memory-corruption condition (CWE-416). Reported by Microsoft with a vendor patch already available; there is no public exploit identified at time of analysis and SSVC records exploitation status as none. EPSS is low at 0.25% (16th percentile), consistent with a locally-exploitable EoP that is not yet weaponized.
Local privilege escalation in the Windows MIDI Service Module affects Windows 11 versions 24H2, 25H2, and 26H1, where a use-after-free (CWE-416) memory-corruption flaw lets an already-authenticated local user elevate to higher privileges. Exploitation requires winning a race condition (high attack complexity), and Microsoft has released a fix; no public exploit identified at time of analysis. Rated CVSS 7.0 with full confidentiality, integrity, and availability impact once triggered.
Local privilege elevation in the Windows WebView component affects a broad range of currently-supported Windows client and server builds (Windows 10 1809 through Windows 11 26H1, and Windows Server 2019/2022/2025). By triggering a use-after-free (CWE-416) memory-corruption condition, an already-authenticated low-privilege attacker can execute code in a higher-privilege context, yielding full confidentiality, integrity, and availability impact on the local system. Microsoft has released a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Local privilege escalation in Microsoft XML Core Services (MSXML) lets an already-authenticated user on affected Windows 10, Windows 11, and Windows Server systems corrupt memory via a use-after-free (CWE-416) and run code at elevated privilege. The flaw was reported by Microsoft and is patched; there is no public exploit identified at time of analysis, and EPSS estimates a low 0.25% (16th percentile) exploitation probability. Impact is total (high confidentiality, integrity, and availability) but requires prior local access.
Arbitrary code execution in Microsoft Office Excel arises from a use-after-free (CWE-416) memory-corruption flaw affecting Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, Office for Mac, and Office Online Server. The CVSS 3.1 vector (AV:L/UI:R) makes this a user-interaction-dependent, locally-scoped issue: a victim must open a maliciously crafted Excel workbook, after which the attacker gains code execution in the user's security context. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but a vendor patch is available.
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary code in the context of the current user when a victim opens a maliciously crafted document. The flaw affects a broad Office footprint including Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024 (Windows and Mac), and related SharePoint Server products that process Word documents. Microsoft has released a patch; no public exploit has been identified at time of analysis, and neither KEV nor EPSS/POC signals were provided in the input.
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, and Word 2016) allows an attacker to run arbitrary code by exploiting a use-after-free memory corruption flaw when a victim opens a maliciously crafted document. The CVSS 3.1 base score is 7.8 with a local attack vector requiring user interaction; there is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. Microsoft, which reported the issue itself, has released a patch.
Local code execution in Microsoft Excel (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, and Office Online Server) arises from a type-confusion flaw (CWE-843) in how Excel parses spreadsheet content. An attacker who convinces a victim to open a malicious workbook can run arbitrary code in the context of the current user, gaining high confidentiality, integrity, and availability impact. Reported by Microsoft with a patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local arbitrary code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office for Mac 2021/2024) arises from a type-confusion flaw (CWE-843) that lets an attacker run code in the context of the current user when a victim opens a crafted file. The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:N/UI:R) reflecting local vector with required user interaction and high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a vendor patch is available via MSRC.
Local code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office for Mac) stems from a use-after-free memory corruption (CWE-416) that an attacker triggers when a victim opens a maliciously crafted document. Rated CVSS 7.8 with high confidentiality, integrity, and availability impact, exploitation requires user interaction but no prior authentication, letting an attacker run arbitrary code in the context of the current user. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Microsoft has released a fix, so patching should be prioritized during the normal Patch Tuesday cycle.
Local code execution in Microsoft Excel (Office 2016 through LTSC 2024, Microsoft 365 Apps, and Mac editions) allows an attacker to run arbitrary code by tricking a user into opening a maliciously crafted spreadsheet that triggers a type-confusion condition in Excel's file parser. The CVSS 3.1 score is 7.8 (High) with the local vector reflecting file-open exploitation rather than remote-network access, and success requires user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, Microsoft 365 Apps, and Office for Mac 2021/2024) arises from a use-after-free memory corruption flaw that an attacker triggers by convincing a user to open a maliciously crafted Office document. Successful exploitation runs arbitrary code in the context of the current user, yielding full confidentiality, integrity, and availability impact on the host. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; Microsoft has published a patch via MSRC.
Local code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, Microsoft 365 Apps, and the macOS editions) arises from a use-after-free memory-corruption flaw (CWE-416) that lets an attacker run arbitrary code in the context of the current user after the victim opens a maliciously crafted document. The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:N/UI:R) with high impact to confidentiality, integrity, and availability, and requires user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a vendor patch is available via MSRC.
Local code execution in Microsoft Office Excel (across Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, and their macOS equivalents) arises from a use-after-free (CWE-416) memory-corruption flaw triggered when a user opens a maliciously crafted spreadsheet. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates an unauthenticated attacker can achieve full confidentiality, integrity, and availability impact but requires the victim to open a file, making it a classic phishing-delivered client-side bug. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Excel memory-corruption bugs are historically attractive targets.
Local code execution in Microsoft Office (including Microsoft 365 Apps for Enterprise, Office 2016/2019, and Office LTSC 2021/2024) stems from a use-after-free memory-corruption flaw (CWE-416). An attacker who convinces a user to open a specially crafted Office document can execute arbitrary code in the context of the current user, gaining full confidentiality, integrity, and availability impact. Exploitation requires user interaction (opening a malicious file) and there is no public exploit identified at time of analysis.
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw affecting a broad range of Windows 10, Windows 11, and Windows Server releases (Server 2012 through Server 2025). Per the CVSS vector an unauthenticated attacker with local access can achieve high-impact code execution with no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Microsoft has released a patch through the MSRC update guide.
Local privilege escalation in the Windows Clipboard Server (Cliprdr/RDP clipboard virtual channel service) affects a broad range of Windows 10, Windows 11, and Windows Server builds (from 1809 through 11 26H1 and Server 2025). An authenticated local attacker who can trigger a use-after-free (CWE-416) in the service can corrupt memory to run code at elevated (SYSTEM-level) privilege. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; Microsoft has released a patch.
Remote code execution in Microsoft Windows OLE (Object Linking and Embedding) allows an unauthorized network attacker to run arbitrary code by triggering a type-confusion condition (CWE-843) in the OLE component. The flaw affects a broad range of client and server SKUs from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025, and carries a CVSS 8.1 (High) rating. No privileges or authentication are required per the CVSS vector, though the high attack complexity (AC:H) means exploitation depends on winning a specific timing or memory-state condition; there is no public exploit identified at time of analysis and it is not on CISA KEV.
Local privilege escalation in the Microsoft Windows Kernel affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a use-after-free memory-corruption flaw lets an already-authenticated local user execute code with SYSTEM-level privileges. No public exploit identified at time of analysis, and CISA SSVC records exploitation as none; the low EPSS score (0.32%, 24th percentile) reflects the absence of observed exploitation, though the total technical impact makes it a valuable second-stage escalation primitive. Reported by Microsoft with a vendor patch available.
Local privilege escalation in the Microsoft Windows Kernel allows an authenticated attacker to gain SYSTEM-level control by exploiting a use-after-free (CWE-416) memory corruption condition. The flaw affects a broad range of Windows client and server builds - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025 - and was reported by Microsoft with a patch available. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.8 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
Local privilege escalation in Microsoft Windows Media (a component shipping in Windows 11 versions 24H2, 25H2, and 26H1) lets an authenticated local attacker execute code at elevated privilege by triggering a use-after-free (CWE-416) memory-corruption condition. Reported by Microsoft with a vendor patch available, it carries CVSS 7.8 (High) and can yield full confidentiality, integrity, and availability compromise of the host. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Microsoft Windows USB Print Driver (usbprint) affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a use-after-free memory-corruption flaw lets an already-authenticated local user execute code with elevated (SYSTEM-level) privileges. Reported by Microsoft with a vendor patch available and an SSVC 'total' technical-impact rating, it currently has no public exploit and a low EPSS score (0.25%, 16th percentile), indicating no observed exploitation to date. The bug requires an existing low-privilege foothold on the machine, making it a post-compromise escalation primitive rather than an initial-access vector.
Local privilege escalation in Microsoft Windows NTFS (New Technology File System) driver lets an already-authenticated low-privileged user corrupt kernel memory via a use-after-free (CWE-416) and elevate to SYSTEM. The flaw affects a broad Windows client and server matrix (Windows 10 1809 through Windows 11 26H1, Windows Server 2019/2022/2025). It has no public exploit identified at time of analysis and is not on CISA KEV, but as a Microsoft-reported, patched NTFS kernel bug it is a routine patch-priority item on standard Patch Tuesday cycles.
Privilege escalation in the Windows Remote Access Connection Manager (RasMan) service lets an authenticated, low-privileged attacker corrupt memory over the network to gain higher privileges on affected Windows 10, 11, and Server systems. The flaw is a CWE-416 use-after-free carrying a CVSS 8.8 with high impact to confidentiality, integrity, and availability. Microsoft has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in the Microsoft Message Queuing (MSMQ) service across Windows 10, Windows 11 (through 26H1), and Windows Server 2012-2025 allows an authorized (PR:L) attacker to run arbitrary code over the network by triggering a use-after-free memory-corruption condition. Microsoft self-reported the flaw and has shipped fixed builds; SSVC rates exploitation as none and EPSS is low (0.48%, 38th percentile), so there is no public exploit identified at time of analysis despite the high 8.8 CVSSv3.1 base score.
Local privilege escalation in the Microsoft Windows Installer (MSI) service affects a broad range of Windows client and server releases, from Windows 10 1607 and Server 2012 through Windows 11 25H2/26H1 and Server 2025. A use-after-free (CWE-416) in the Windows Installer component lets a low-privileged authenticated attacker who already has local code execution corrupt memory to run code with elevated (SYSTEM-level) privileges. No public exploit identified at time of analysis and the SSVC exploitation status is 'none', but the technical impact is rated total and Microsoft has shipped a patch.
Privilege escalation in the Windows Netlogon service allows an authenticated network attacker to gain elevated privileges by triggering a use-after-free (CWE-416) memory-corruption condition. The flaw affects a broad range of supported Windows client and server builds, from Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025, and was reported by Microsoft. There is no public exploit identified at time of analysis and CISA SSVC currently rates exploitation as none, with a low EPSS of 0.62%.
Privilege elevation via a use-after-free in the Microsoft Windows DNS component lets a network-based, unauthenticated attacker corrupt memory and potentially gain higher privileges on affected Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 systems. Microsoft rates it CVSS 9.8, and the SSVC assessment lists total technical impact but notes no observed exploitation and that it is not automatable. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.67% (48th percentile).
Elevation of privilege in the Windows Runtime (WinRT) component affects Windows 10 (21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2025, where a use-after-free memory-corruption flaw lets an already-authenticated local user run code at higher privilege. Microsoft has released a patch and reported the issue; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. Given the CVSS 7.8 (Important) rating and full C/I/A impact, this is a standard local privilege-escalation risk suited for regular patch prioritization rather than emergency response.
Local privilege escalation in the Windows Graphics Kernel component allows an authenticated attacker to elevate to SYSTEM by triggering a use-after-free (CWE-416) memory-corruption condition. All currently supported Windows client and server builds are affected - from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. No public exploit identified at time of analysis; Microsoft has released a patch, and the CVSS 7.8 (Important) rating reflects high impact but a local-access, low-privilege prerequisite.
Local privilege escalation in the Microsoft Windows Kernel lets an authenticated attacker who already has low-privileged code execution on a host elevate to SYSTEM by exploiting a use-after-free (CWE-416) memory corruption. It affects a broad range of supported Windows client and server builds - Windows 10 (1809/21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2019/2022/2025 - and Microsoft has released a patch. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation appears unproven publicly despite the reliably-exploitable nature of kernel UAF flaws.
Local privilege escalation in the Microsoft Windows Kernel lets an authenticated low-privileged user exploit a use-after-free (CWE-416) memory corruption flaw to elevate to SYSTEM across a broad range of Windows 10, Windows 11, and Windows Server builds. Reported by Microsoft and rated CVSS 7.8, it is not currently in CISA KEV and has no public exploit identified at time of analysis; the EPSS score is low at 0.26% (17th percentile). A vendor patch is available via the MSRC update guide.
Local privilege escalation in the Windows Backup Engine affects a broad range of Windows 10 (21H2, 22H2) and Windows 11 (24H2, 25H2, 26H1) builds, where a use-after-free (CWE-416) lets an already-authenticated local attacker corrupt memory and gain SYSTEM-level control. Microsoft rates it 7.8 (AV:L/PR:L) with total confidentiality, integrity, and availability impact, and a patch is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.25% (16th percentile).
Local privilege escalation in Microsoft Windows (Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025) arises from a use-after-free memory-corruption flaw (CWE-416) that lets an already-authenticated local user run code at elevated privilege. The CVSS 3.1 base score is 7.8 with a scope-changed vector, and Microsoft has shipped a fix via MSRC. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is currently theoretical rather than observed.
Local privilege escalation in the Windows Brokering File System affects Windows 11 24H2/25H2/26H1 and Windows Server 2025, where a use-after-free (CWE-416) lets an already-authenticated local user corrupt memory to elevate to higher privileges (typically SYSTEM). Microsoft has released a patch and rates it 7.8 (High). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Microsoft's Remote Desktop Client (the RDP client, mstsc.exe, shipped across Windows 10, Windows 11, and Windows Server 2012 through 2025) allows an unauthorized attacker to run arbitrary code over the network by triggering a use-after-free memory-corruption condition. Exploitation requires the victim to connect to an attacker-controlled or compromised RDP endpoint (UI:R), after which the malicious server can corrupt client-side memory to achieve full code execution. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; a vendor patch is available from Microsoft.
Local privilege escalation in the Windows Runtime (WinRT) component of Windows 10, Windows 11, and Windows Server allows an authenticated attacker to run arbitrary code with elevated (SYSTEM-level) privileges by triggering a use-after-free memory-corruption condition (CWE-416). Microsoft has released a patch, but there is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. The CVSS 3.1 score of 7.8 (High) with a fully local vector reflects meaningful post-compromise impact but requires the attacker to already have a foothold on the host.
Remote code execution in the Microsoft Message Queuing (MSMQ) Queue Manager affects a broad range of Windows client and server releases, from Windows 10 1607 and Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025. A use-after-free (CWE-416) in the queue manager lets a remote, unauthenticated attacker who can reach the MSMQ service execute arbitrary code with total impact to confidentiality, integrity, and availability. Microsoft has released patches; there is no public exploit identified at time of analysis and the EPSS probability is modest at 0.52%.
Local privilege escalation in the Windows Brokering File System component affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a use-after-free memory corruption (CWE-416) lets an already-authenticated local user elevate to higher privileges. Microsoft rates it CVSS 7.8 with full confidentiality, integrity, and availability impact, and has released a patch. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Windows Connected User Experiences and Telemetry service (DiagTrack) lets an already-authenticated user run arbitrary code with SYSTEM-level rights by triggering a CWE-843 type-confusion condition. The flaw affects a broad range of currently-supported Windows client and server builds, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Local privilege escalation in the Microsoft Windows Content Delivery Manager component lets an authenticated low-privileged user elevate to SYSTEM by triggering a use-after-free (CWE-416) memory-corruption condition. The flaw affects a broad range of client and server builds (Windows 10 1809 through Windows 11 26H1, plus Server 2019 and Server 2025), and Microsoft has released a patch. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Windows Runtime (WinRT) affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a use-after-free memory-corruption flaw lets a locally authenticated attacker elevate to higher privileges. Per the CVSS vector an already-authorized low-privileged user (PR:L) can execute the attack without user interaction, gaining full confidentiality, integrity, and availability impact on the host. There is no public exploit identified at time of analysis and CISA SSVC rates current exploitation as none, though a vendor patch is available from Microsoft.
Privilege escalation in Windows Remote Desktop Services (RDS) lets an authenticated, low-privileged attacker elevate to higher privileges across a network by triggering a use-after-free (CWE-416) memory-corruption condition in the RDS component. The flaw spans a broad range of supported Windows client and server releases (Windows 10/11 and Windows Server 2012 through 2025). Microsoft has released a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Local privilege escalation in the Windows Kernel affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 (including Server Core), where an authorized attacker can exploit a use-after-free (CWE-416) memory-corruption condition to elevate privileges to SYSTEM. The flaw was reported by Microsoft, which has released a patch, and carries a CVSS 7.8 rating driven entirely by high confidentiality, integrity, and availability impact once local access is obtained. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Microsoft Windows Kernel lets an already-authenticated attacker win a use-after-free race (CWE-416) to gain SYSTEM-level control, affecting a broad range of client and server builds from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released a patch and there is no public exploit identified at time of analysis. The moderate 7.0 score reflects high attack complexity (a timing-dependent race) offset by full confidentiality, integrity and availability impact once triggered.
Local privilege escalation in Microsoft Windows Media (the Windows Media component/codec subsystem) allows an already-authenticated local attacker to elevate to SYSTEM by triggering a use-after-free (CWE-416) memory corruption condition. The flaw affects a broad range of currently-supported Windows client and server releases, from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Local privilege escalation in the Windows Runtime (WinRT) affects a broad range of supported Windows client and server releases, from Windows 10 1809 and Windows Server 2019 through Windows 11 26H1 and Windows Server 2025. An authorized local attacker who can execute low-privilege code can trigger a use-after-free (CWE-416) memory-corruption condition to elevate privileges, yielding full confidentiality, integrity, and availability impact on the host. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Microsoft has released a patch.
Local privilege escalation in Microsoft Windows Runtime (WinRT) affects a broad range of Windows client and server builds, from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. An authorized local attacker who can run low-privileged code can trigger a use-after-free memory-corruption condition to elevate to higher privileges, with high confidentiality, integrity, and availability impact implying a path to SYSTEM. No public exploit identified at time of analysis, and the flaw is not on CISA KEV; a vendor patch is available.
Local privilege escalation in the Windows DirectX graphics kernel subsystem allows an authenticated attacker to elevate to SYSTEM by triggering a use-after-free (CWE-416) memory-corruption condition across Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025. The CVSS 3.1 vector (7.8, AV:L/PR:L) confirms local access and low existing privileges are required with no user interaction, yielding full confidentiality, integrity, and availability impact. Reported by Microsoft with a vendor patch available; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Local privilege escalation in the Windows Media component across Windows 10, Windows 11, and Windows Server (2016 through 2025) allows an authenticated low-privileged attacker to elevate to SYSTEM by exploiting a use-after-free memory corruption flaw. Microsoft has released patches and reports no public exploit identified at time of analysis; EPSS is low at 0.25% and CISA SSVC records exploitation status as 'none', though technical impact is rated total. Given the ubiquity of the Windows Media stack, this is a routine but broadly applicable Patch-Tuesday-class local EoP.
Privilege escalation in Microsoft Windows Runtime (WinRT) lets an authenticated attacker who can reach an affected host over the network exploit a use-after-free memory corruption to gain higher privileges, with total confidentiality, integrity, and availability impact per CVSS 8.8. Affected platforms include Windows 11 (24H2, 25H2, 26H1), Windows Server 2025, and its Server Core installation. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.48%, 38th percentile), but the technical impact is rated total and a vendor patch is available.
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker gain SYSTEM-level control by abusing a type-confusion (CWE-843) condition, affecting a broad range of Windows client and server builds from Windows Server 2012 through Windows 11 25H2/26H1 and Server 2025. Successful exploitation yields total loss of confidentiality, integrity, and availability on the host, though there is no public exploit identified at time of analysis and CISA's SSVC framework rates exploitation as 'none' and non-automatable. EPSS is low (0.29%, 21st percentile), consistent with a locally-scoped bug that requires prior code execution rather than a remotely wormable threat.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated low-privileged attacker to gain SYSTEM-level control by triggering a use-after-free condition in the kernel networking driver. The flaw affects a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Reported by Microsoft with a vendor patch available; no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.31%).
Local privilege escalation in the Windows Internal System User Profile component allows an already-authenticated attacker to gain elevated (SYSTEM-level) privileges by triggering a use-after-free memory corruption condition (CWE-416). The flaw affects Windows 10 (21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2025 including Server Core. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 7.8 rating and full high impact on confidentiality, integrity, and availability make it a meaningful patch-cycle priority.
Local privilege escalation in Windows Kernel-Mode Drivers on Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 lets an already-authenticated low-privilege user corrupt kernel memory via a use-after-free (CWE-416) and gain SYSTEM-level control. Reported by Microsoft with a vendor patch available; there is no public exploit identified at time of analysis and CISA SSVC rates exploitation as none, though the technical impact is total. EPSS is low (0.20%, 10th percentile), consistent with a not-yet-exploited but fully impactful local EoP.
Local privilege escalation in the Windows Application Model (the subsystem underlying UWP/packaged app lifecycle and activation) lets an authorized attacker with an existing low-privileged foothold gain SYSTEM-level control by triggering a use-after-free memory-corruption condition. All supported Windows client and server builds from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through Server 2025 are affected. This is a Microsoft-reported flaw with a vendor patch available; there is no public exploit identified at time of analysis and it is not on CISA KEV.
Local privilege escalation in the Windows Unified Consent System (UCS) lets an already-authenticated attacker exploit a use-after-free memory-corruption flaw (CWE-416) to gain higher privileges, potentially up to SYSTEM. It affects a broad range of current Windows client and server builds including Windows 10 21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2025. Reported by Microsoft with a CVSS 3.1 base score of 7.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in the Windows TCP/IP stack lets a low-privileged authenticated user corrupt kernel memory via a use-after-free (CWE-416) and elevate to SYSTEM. It affects a broad range of Windows 10, Windows 11, and Windows Server builds through 2025, was reported by Microsoft, and carries CVSS 7.8; there is no public exploit identified at time of analysis and EPSS is low (0.20%, 10th percentile).
Local privilege escalation in Windows Kernel-Mode Drivers on Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 allows an authenticated low-privileged attacker to gain SYSTEM-level control by exploiting a use-after-free (CWE-416) memory-corruption condition. Microsoft has published a patch, and no public exploit has been identified at time of analysis; EPSS is low at 0.20% (10th percentile) and CISA SSVC records exploitation as none, though the technical impact is rated total. Successful exploitation grants full confidentiality, integrity, and availability compromise of the affected host.
Local privilege elevation in the Microsoft Windows TCP/IP networking stack lets an already-authenticated, low-privileged user corrupt kernel memory via a use-after-free (CWE-416) and gain SYSTEM-level control. The flaw affects a broad range of client and server SKUs from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025, including Server Core installations. Microsoft reported the issue and has released a patch; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Local privilege escalation in Windows Secure Kernel Mode (VBS/Isolated User Mode trust boundary) affects Windows 11 24H2/25H2/26H1 and Windows Server 2025, where a use-after-free (CWE-416) lets an already-authenticated local attacker gain elevated privileges. Microsoft rates it 7.0 (High) with a local, high-complexity vector requiring low privileges and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation would require winning a memory-corruption race after already having a foothold.
Local privilege escalation in the Microsoft Windows Kernel allows an already-authenticated attacker to gain SYSTEM-level control by exploiting a use-after-free (CWE-416) memory corruption condition. The flaw affects a broad range of supported Windows client and server releases (Windows 10 1809 through Windows 11 26H1, and Windows Server 2019 through 2025) and, per the CVSS 7.8 vector, yields full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; Microsoft has released a patch.
Local privilege escalation in the Microsoft Brokering File System affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a use-after-free (CWE-416) memory-corruption flaw lets an already-authenticated local user execute code with elevated (typically SYSTEM) privileges. Microsoft has released a patch and reported the issue itself; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a locally-exploitable but high-impact elevation path.
Local privilege escalation in the Microsoft Windows Graphics Kernel component allows a low-privileged local user to elevate to SYSTEM by exploiting a use-after-free (CWE-416) memory corruption condition. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server releases, was reported by Microsoft, and has a vendor-released patch available. No public exploit is identified at time of analysis and it is not listed in CISA KEV; the high attack complexity (AC:H) makes reliable exploitation non-trivial.
Local privilege escalation in the Windows Kernel lets an already-authenticated, low-privileged user corrupt kernel memory via a use-after-free (CWE-416) and gain higher privileges on the host. The flaw affects a broad range of currently-supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025); Microsoft has shipped a fix. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Local privilege escalation in the Windows taskbar (Internal Task Bar component) allows an authenticated attacker to elevate to higher privileges by exploiting a use-after-free memory corruption flaw. The issue affects a broad range of current Windows client and server builds (Windows 10 21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2025), was reported by Microsoft itself, and is fixed via a vendor patch. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in Windows Runtime (WinRT) on Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 allows an authenticated local user to gain higher privileges by exploiting a use-after-free memory-corruption flaw (CWE-416). Successful exploitation yields high confidentiality, integrity, and availability impact, effectively enabling escalation to SYSTEM-level control on the host. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the elevated attack complexity (AC:H) indicates exploitation requires winning a race or meeting specific timing/heap conditions.
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-level) privileges by triggering a use-after-free condition (CWE-416) in kernel memory. The flaw affects a broad range of supported Windows client and server releases, from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-after-free (CWE-416) and gain full control of the host. The CVSS 3.1 vector (AV:L/PR:L, scope-changed with C:H/I:H/A:H) reflects a low-privileged local user escalating to SYSTEM-level compromise across a broad range of Windows 10, Windows 11, and Windows Server builds. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Microsoft has released a patch.
Local privilege escalation in the Windows Kernel Mode Driver affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a use-after-free (CWE-416) lets an already-authenticated local attacker corrupt kernel memory and elevate to SYSTEM. Reported by Microsoft with a patch already available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 7.8 (AV:L/PR:L) reflects a high-impact but locally-scoped flaw requiring an existing foothold on the host.
Local privilege escalation in the Windows Storage component affects a broad range of Windows client and server builds (Windows 10 1809 through Windows 11 26H1, and Windows Server 2019 through 2025). By exploiting a use-after-free memory-corruption flaw (CWE-416), an already-authenticated local attacker can elevate to SYSTEM-level privileges. Reported by Microsoft with a patch available; there is no public exploit identified at time of analysis, EPSS is low (0.15%), and CISA SSVC records exploitation status as none.
Local privilege escalation in Microsoft Windows Hyper-V (Windows 11 24H2/25H2/26H1 and Windows Server 2022/2025) stems from a use-after-free memory-corruption condition that lets an attacker with a local foothold execute code at elevated, potentially SYSTEM/hypervisor-level privilege. Microsoft rates it CVSS 8.4 with total confidentiality, integrity, and availability impact, and there is no public exploit identified at time of analysis. EPSS is low (0.24%, 16th percentile) and CISA SSVC lists exploitation status as none, so this is a high-severity patch-on-cycle item rather than an actively exploited emergency.
Remote code execution in Microsoft Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized network attacker to run arbitrary code by triggering a use-after-free (CWE-416) memory-corruption condition. The flaw affects a broad range of Windows client and server releases from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025, and per its CVSS 9.8 vector requires no authentication or user interaction. There is no public exploit identified at time of analysis, and the EPSS probability is modest (0.61%), so despite the critical score exploitation is not yet observed.